Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Again CWS_xplugin

dustin

Posted 17 October 2004 - 10:46 PM

dustin

Member

Member

11 posts

I have been having a problem with adware file CWS_xplugin . I used spysweeper and it tells me the file is located in HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings || proxyoverride . I used spysweeper and deleted it. Went into regedit and took the file out also. I reboot and the file keeps coming back. I have tried spysweeper, spybot, cwsshredder, and hijackthis, and still no luck. Anyone have any ideas to help me get rid of this file?

dustin

Posted 18 October 2004 - 07:09 PM

dustin

Member

Topic Starter

Member

11 posts

hi coach,

Ad-aware can't solve this problem,it does not detect cws_xplugin like Spybots&d,CWshredder and others.Only SpySweeper detects it ,but remove this plugin temporary only.I think all the matter is more complex.It's possible that it creates a new protocol filter for txt\html or deleted some system files. I can't find any file or .dll of this plugin,it seems not existing but websurfing is very slowly(adsl!).I have to remove it (and registry item "proxyoverride") everytime I run IE and everytime I reboot.
Untill now,nobody could have fix this problem because nobody exactly knows what kind of action performed on system and where to find this plugin.Just incredible! I don't know what to do more.Now all I can do is hope for some miracle.Thanks however and by.

Posted 18 October 2004 - 07:35 PM

admin

Posted 18 October 2004 - 10:17 PM

admin

Founder Geek

Administrator

24,548 posts

This looks to be a false positive by SpySweeper to me. CWS_xplugin is an old hijack that should be removed by the latest CWShredder. If you are infected by this Hijack, all your Google searches will be directed to CoolWebSearch pages. Are you experiencing this?

dustin

Posted 20 October 2004 - 03:12 PM

dustin

Member

Topic Starter

Member

11 posts

hi,

I don't think of false positive,because when this spy is present surfing is very slowly and it tries to redirect probably to coolwebsearch pages.CWShredder doesn't detect cws_xplugin.I used it.It will be also an old spy but untill now nobodycan removed it definitively.However,there is the log:

lotuseclat79

Posted 21 October 2004 - 01:58 PM

The solution seems to be to upgrade to the latest SpySweeper to solve this problem with CWS_xplugin.

I am having the same problem with CWS_xplugin and found the above URL and the URL to this web page by searching the Web with Momma Metasearch, the mother of all search engines at http://www.mamma.com for both CWS_xplugin and CWS.xplugin.

I use a variant of SpySweeper from Earthlink (a Webroot partner) named SpywareBlocker which is v2.2 whereas the person running v3.0 needed to upgrade to v3.2 to get the solution.

dustin

Posted 22 October 2004 - 01:52 PM

The solution seems to be to upgrade to the latest SpySweeper to solve this problem with CWS_xplugin.

I am having the same problem with CWS_xplugin and found the above URL and the URL to this web page by searching the Web with Momma Metasearch, the mother of all search engines at http://www.mamma.com for both CWS_xplugin and CWS.xplugin.

I use a variant of SpySweeper from Earthlink (a Webroot partner) named SpywareBlocker which is v2.2 whereas the person running v3.0 needed to upgrade to v3.2 to get the solution.

I hope the solution works for us.

Ciao,

-- Tom

Hi tom,

I updated to version 3.2 and problem seems to be solved.Seems,because this version don't detects anymore cws_xplugin and I don't knoow if it has been deleted or there is again.However is the matter,websurfing now is good and there are not redirections.Thanks for your help.Now,I run spyaudit online(Spyblocker site) and find this Hitbox cookie

Spy #f4f85 -- Research In Progress

Adaware,SpyBot and SpyWeeper don't detect it .I don't know how to delete.Have you another tip for this?

lotuseclat79

Posted 22 October 2004 - 02:57 PM

The solution seems to be to upgrade to the latest SpySweeper to solve this problem with CWS_xplugin.

I am having the same problem with CWS_xplugin and found the above URL and the URL to this web page by searching the Web with Momma Metasearch, the mother of all search engines at http://www.mamma.com for both CWS_xplugin and CWS.xplugin.

I use a variant of SpySweeper from Earthlink (a Webroot partner) named SpywareBlocker which is v2.2 whereas the person running v3.0 needed to upgrade to v3.2 to get the solution.

I hope the solution works for us.

Ciao,

-- Tom

Hi tom,

I updated to version 3.2 and problem seems to be solved.Seems,because this version don't detects anymore cws_xplugin and I don't knoow if it has been deleted or there is again.However is the matter,websurfing now is good and there are not redirections.Thanks for your help.Now,I run spyaudit online(Spyblocker site) and find this Hitbox cookie

Spy #f4f85 -- Research In Progress

Adaware,SpyBot and SpyWeeper don't detect it .I don't know how to delete.Have you another tip for this?

dustin

Dustin,

I am an EarthLink subscriber with SpywareBlocker v2.2.0, build 44, spyware definitions 403. I got the trial v3.2 of SpySweeper from Webroot's download site.I run Win98SE.Here's the results:1) SpywareBlocker detects CWS_xplugin and allows temporary disabling of CWS_xplugin (my current problem as it is very persistent at coming back)2) You have to turn off SpywareBlocker (use task panel to kill the process)3) I had to uninstall SpySweeper, kill SpywareBlocker, then reinstall SpySweeper then update to definitions 404 prior to running a full system sweep (scan)4) SpySweeper v3.2, definitions 404 does not detect CWS_xplugin.5) If you bought v3.2 from Webroot, and your scan detected and quarantined CWS_xplugin, then you are probably ok with SpySweeper's shields and defs 405.6) Since I have the trial v3.2 of SpySweeper, Webroot is mailing me SpySweeper w/defs 405 - I can only hope that EarthLink's mail software can handle it.

I verified that CWS_xplugin was still there after my first scan with the trial v3.2 of SpySweeper by reloading/reinstalling SpywareBlocker with defs 403 - it detected CWS_xplugin.

If you bought the product v3.2 of SpySweeper, can you tell me the files it detected?

Thanks,

-- Tom

P.S. If you only have the trial v3.2 of SpySweeper (like myself), you may not be able to detect that CWS_xplugin is there.

My only hope may be to buy SpySweeper - it appears that Marketing and Sales at Webroot have the upper hand on what they allow on their servers for trial software.

dustin

Posted 23 October 2004 - 06:28 PM

The solution seems to be to upgrade to the latest SpySweeper to solve this problem with CWS_xplugin.

I am having the same problem with CWS_xplugin and found the above URL and the URL to this web page by searching the Web with Momma Metasearch, the mother of all search engines at http://www.mamma.com for both CWS_xplugin and CWS.xplugin.

I use a variant of SpySweeper from Earthlink (a Webroot partner) named SpywareBlocker which is v2.2 whereas the person running v3.0 needed to upgrade to v3.2 to get the solution.

I hope the solution works for us.

Ciao,

-- Tom

Hi tom,

I updated to version 3.2 and problem seems to be solved.Seems,because this version don't detects anymore cws_xplugin and I don't knoow if it has been deleted or there is again.However is the matter,websurfing now is good and there are not redirections.Thanks for your help.Now,I run spyaudit online(Spyblocker site) and find this Hitbox cookie

Spy #f4f85 -- Research In Progress

Adaware,SpyBot and SpyWeeper don't detect it .I don't know how to delete.Have you another tip for this?

dustin

Dustin,

I am an EarthLink subscriber with SpywareBlocker v2.2.0, build 44, spyware definitions 403. I got the trial v3.2 of SpySweeper from Webroot's download site.I run Win98SE.Here's the results:1) SpywareBlocker detects CWS_xplugin and allows temporary disabling of CWS_xplugin (my current problem as it is very persistent at coming back)2) You have to turn off SpywareBlocker (use task panel to kill the process)3) I had to uninstall SpySweeper, kill SpywareBlocker, then reinstall SpySweeper then update to definitions 404 prior to running a full system sweep (scan)4) SpySweeper v3.2, definitions 404 does not detect CWS_xplugin.5) If you bought v3.2 from Webroot, and your scan detected and quarantined CWS_xplugin, then you are probably ok with SpySweeper's shields and defs 405.6) Since I have the trial v3.2 of SpySweeper, Webroot is mailing me SpySweeper w/defs 405 - I can only hope that EarthLink's mail software can handle it.

I verified that CWS_xplugin was still there after my first scan with the trial v3.2 of SpySweeper by reloading/reinstalling SpywareBlocker with defs 403 - it detected CWS_xplugin.

If you bought the product v3.2 of SpySweeper, can you tell me the files it detected?

Thanks,

-- Tom

P.S. If you only have the trial v3.2 of SpySweeper (like myself), you may not be able to detect that CWS_xplugin is there.

My only hope may be to buy SpySweeper - it appears that Marketing and Sales at Webroot have the upper hand on what they allow on their servers for trial software.

I have no information on Spy #f4f85

hi tom.

I had SpySweeper 3.0, I don't remember if 403 or other,and it detected ,quarantined and deleted cws_xplugin but not definitively.Everytime I reboot was still there.Websurfing was very slowly and it tries to redirect.... So I uninstalled 3.0 and now I haveinstalled v.3.2,build 416,def.405.I have scanned and I haven't found anything.I don't know if the plugin is still there,but surfing is very good and withoutproblems,then I presume to have definitively deleted cws_xplugin,I hope...Sincerly, I don't understand how that happened,given that 3.2\405 doesn't detect it.I run xp home(Is it possible to have only Spyblocker and not the entire suite?)

PS-delete all temp files(in all folders) and index .dat files.See also how is host file.